🔍

SOA-C02 — questions

Page 12 of 24 · 477 total questions.

SOA-C02 Question 221

Single page →
Topic 1 · Question 221

A company’s application currently uses an IAM role that allows all access to all AWS services. A SysOps administrator must ensure that the company’s IAM policies allow only the permissions that the application requires. How can the SysOps administrator create a policy to meet this requirement?

  • ATurn on AWS CloudTrail. Generate a policy by using AWS Security Hub.
  • BTurn on Amazon EventBridge (Amazon CloudWatch Events). Generate a policy by using AWS Identity and Access Management Access Analyzer.
  • CUse the AWS CLI to run the get-generated-policy command in AWS Identity and Access Management Access Analyzer.
  • DTurn on AWS CloudTrail. Generate a policy by using AWS Identity and Access Management Access Analyzer. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Turn on AWS CloudTrail. Generate a policy by using AWS Identity and Access Management Access Analyzer.

Explanation

AWS CloudTrail records API activity for auditing and governance.

SOA-C02 Question 222

Single page →
Topic 1 · Question 222

A company is deploying a third-party unit testing solution that is delivered as an Amazon EC2 Amazon Machine Image (AMI). All system configuration data is stored in Amazon DynamoDB. The testing results are stored in Amazon S3. A minimum of three EC2 instances are required to operate the product. The company’s testing team wants to use an additional three EC2 instances when the Spot Instance prices are at a certain threshold. A SysOps administrator must implement a highly available solution that provides this functionality. Which solution will meet these requirements with the LEAST operational overhead?

  • ADefine an Amazon EC2 Auto Scaling group by using a launch configuration. Use the provided AMI in the launch configuration. Configure three On-Demand Instances and three Spot Instances. Configure a maximum Spot Instance price in the launch configuration.
  • BDefine an Amazon EC2 Auto Scaling group by using a launch template. Use the provided AMI in the launch template. Configure three On-Demand Instances and three Spot instances. Configure a maximum Spot Instance price in the launch template. (correct answer)
  • CDefine two Amazon EC2 Auto Scaling groups by using launch configurations. Use the provided AMI in the launch configurations. Configure three On-Demand Instances for one Auto Scaling group. Configure three Spot Instances for the other Auto Scaling group. Configure a maximum Spot Instance price in the launch configuration for the Auto Scaling group that has Spot Instances.
  • DDefine two Amazon EC2 Auto Scaling groups by using launch templates. Use the provides AMI in the launch templates. Configure three On-Demand Instances for one Auto Scaling group. Configure three Spot Instances for the other Auto Scaling group. Configure a maximum Spot Instance price in the launch template for the Auto Scaling group that has Spot Instances.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Define an Amazon EC2 Auto Scaling group by using a launch template. Use the provided AMI in the launch template. Configure three On-Demand Instances and three Spot instances. Configure a maximum Spot Instance price in...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Spot Instances use spare capacity at a large discount, ideal for fault-tolerant or interruptible workloads. Amazon EC2 provides resizable virtual servers when you need full control of the operating system.

SOA-C02 Question 223

Single page →
Topic 1 · Question 223

A SysOps administrator creates an AWS CloudFormation template to define an application stack that can be deployed in multiple AWS Regions. The SysOps administrator also creates an Amazon CloudWatch dashboard by using the AWS Management Console. Each deployment of the application requires its own CloudWatch dashboard. How can the SysOps administrator automate the creation of the CloudWatch dashboard each time the application is deployed?

  • ACreate a script by using the AWS CLI to run the aws cloudformation put-dashboard command with the name of the dashboard. Run the command each time a new CloudFormation stack is created.
  • BExport the existing CloudWatch dashboard as JSON. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Include the exported JSON in the resource’s DashboardBody property. (correct answer)
  • CUpdate the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Use the Intrinsic Ref function to reference the ID of the existing CloudWatch dashboard.
  • DUpdate the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Specify the name of the existing dashboard in the DashboardName property.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Export the existing CloudWatch dashboard as JSON. Update the CloudFormation template to define an AWS::CloudWatch::Dashboard resource. Include the exported JSON in the resource’s DashboardBody property.

Explanation

Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health. AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 224

Single page →
Topic 1 · Question 224

A company updates its security policy to clarify cloud hosting arrangements for regulated workloads. Workloads that are identified as sensitive must run on hardware that is not shared with other customers or with other AWS accounts within the company. Which solution will ensure compliance with this policy?

  • ADeploy workloads only to Dedicated Hosts. (correct answer)
  • BDeploy workloads only to Dedicated Instances.
  • CDeploy workloads only to Reserved Instances.
  • DPlace all instances in a dedicated placement group.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Deploy workloads only to Dedicated Hosts.

SOA-C02 Question 225

Single page →
Topic 1 · Question 225

A company runs a website from Sydney, Australia. Users in the United States (US) and Europe are reporting that images and videos are taking a long time to load. However, local testing in Australia indicates no performance issues. The website has a large amount of static content in the form of images and videos that are stored in Amazon S3. Which solution will result in the MOST improvement in the user experience for users in the US and Europe?

  • AConfigure AWS PrivateLink for Amazon S3.
  • BConfigure S3 Transfer Acceleration.
  • CCreate an Amazon CloudFront distribution. Distribute the static content to the CloudFront edge locations. (correct answer)
  • DCreate an Amazon API Gateway API in each AWS Region. Cache the content locally.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an Amazon CloudFront distribution. Distribute the static content to the CloudFront edge locations.

Explanation

Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 226

Single page →
Topic 1 · Question 226

A SysOps administrator wants to monitor the free disk space that is available on a set of Amazon EC2 instances that have Amazon Elastic Block Store (Amazon EBS) volumes attached. The SysOps administrator wants to receive a notification when the used disk space of the EBS volumes exceeds a threshold value, but only when the DiskReadOps metric also exceeds a threshold value. The SysOps administrator has set up an Amazon Simple Notification Service (Amazon SNS) topic. How can the SysOps administrator receive notification only when both metrics exceed their threshold values?

  • AInstall the Amazon CloudWatch agent on the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish a notification to the SNS topic. (correct answer)
  • BInstall the Amazon CloudWatch agent on the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Configure each alarm to publish a notification to the SNS topic.
  • CCreate a metric alarm for the EBSByteBalance% metric and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish a notification to the SNS topic.
  • DConfigure detailed monitoring for the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish a notification to the SNS topic.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Install the Amazon CloudWatch agent on the EC2 instances. Create a metric alarm for the disk space and a metric alarm for the DiskReadOps metric. Create a composite alarm that includes the two metric alarms to publish...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 227

Single page →
Topic 1 · Question 227

A company updates its security policy to prohibit the public exposure of any data in Amazon S3 buckets in the company's account. What should a SysOps administrator do to meet this requirement?

  • ATurn on S3 Block Public Access from the account level. (correct answer)
  • BCreate an Amazon Event Bridge (Amazon CloudWatch Events) rule to enforce that all S3 objects are private.
  • CUse Amazon Inspector to search for S3 buckets and to automatically reset S3 ACLs if any public S3 buckets are found.
  • DUse S3 Object Lambda to examine S3 ACLs and to change any public S3 ACLs to private.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Turn on S3 Block Public Access from the account level.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 228

Single page →
Topic 1 · Question 228

A company's SysOps administrator needs to change the AWS Support plan for one of the company's AWS accounts. The account has multi-factor authentication (MFA) activated, and the MFA device is lost. What should the SysOps administrator do to sign in?

  • ASign in as a root user by using email and phone verification. Set up a new MFA device. Change the root user password. (correct answer)
  • BSign in as an IAM user with administrator permissions. Resynchronize the MFA token by using the IAM console.
  • CSign in as an IAM user with administrator permissions. Reset the MFA device for the root user by adding a new device.
  • DUse the forgot-password process to verify the email address. Set up a new password and MFA device.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Sign in as a root user by using email and phone verification. Set up a new MFA device. Change the root user password.

SOA-C02 Question 229

Single page →
Topic 1 · Question 229

A company is creating a new multi-account architecture. A SysOps administrator must implement a login solution to centrally manage user access and permissions across all AWS accounts. The solution must be integrated with AWS Organizations and must be connected to a third-party Security Assertion Markup Language (SAML) 2.0 identity provider (IdP). What should the SysOps administrator do to meet these requirements?

  • AConfigure an Amazon Cognito user pool. Integrate the user pool with the third-party IdP.
  • BEnable and configure AWS Single Sign-On with the third-party IdP. (correct answer)
  • CFederate the third-party IdP with AWS Identity and Access Management (IAM) for each AWS account in the organization.
  • DIntegrate the third-party IdP directly with AWS Organizations.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Enable and configure AWS Single Sign-On with the third-party IdP.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 230

Single page →
Topic 1 · Question 230

A company is managing many accounts by using a single organization in AWS Organizations. The organization has all features enabled. The company wants to turn on AWS Config in all the accounts of the organization and in all AWS Regions. What should a SysOps administrator do to meet these requirements in the MOST operationally efficient way?

  • AUse AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions. (correct answer)
  • BUse AWS CloudFormation Stack Sets to deploy stack policies that turn on AWS Config in all accounts and in all Regions.
  • CUse service control policies (SCPs) to configure AWS Config in all accounts and in all Regions.
  • DCreate a script that uses the AWS CLI to turn on AWS Config in all accounts in the organization. Run the script from the organization's management account.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Use AWS CloudFormation Stack Sets to deploy stack instances that turn on AWS Config in all accounts and in all Regions.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. AWS CloudFormation provisions infrastructure as code repeatably.

SOA-C02 Question 231

Single page →
Topic 1 · Question 231 · Select all that apply

A SysOps administrator needs to delete an AWS CloudFormation stack that is no longer in use. The CloudFormation stack is in the DELETE_FAILED state. The SysOps administrator has validated the permissions that are required to delete the CloudFormation stack. Which of the following are possible causes of the DELETE_FAILED state? (Choose two.)

  • AThe configured timeout to delete the stack was too low for the delete operation to complete.
  • BThe stack contains nested stacks that must be manually deleted first.
  • CThe stack was deployed with the --disable-rollback option.
  • DThere are additional resources associated with a security group in the stack. (correct answer)
  • EThere are Amazon S3 buckets that still contain objects in the stack. (correct answer)
Reveal answer & explanation
Correct answer: D, E

The correct answer is D, E. Option D: There are additional resources associated with a security group in the stack. Option E: There are Amazon S3 buckets that still contain objects in the stack.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SOA-C02 Question 232

Single page →
Topic 1 · Question 232

A SysOps administrator needs to configure a solution that will deliver digital content to a set of authorized users through Amazon CloudFront. Unauthorized users must be restricted from access. Which solution will meet these requirements?

  • AStore the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed URLs to access the S3 bucket through CloudFront.
  • BStore the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Restrict S3 bucket access with signed URLs in CloudFront. (correct answer)
  • CStore the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Enable field-level encryption.
  • DStore the digital content in an Amazon S3 bucket that does not have public access blocked. Use signed cookies for restricted delivery of the content through CloudFront.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Store the digital content in an Amazon S3 bucket that has public access blocked. Use an origin access identity (OAI) to deliver the content through CloudFront. Restrict S3 bucket access with signed URLs in CloudFront.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon CloudFront caches content at edge locations to reduce latency and offload origins.

SOA-C02 Question 233

Single page →
Topic 1 · Question 233

A SysOps administrator must ensure that a company's Amazon EC2 instances auto scale as expected. The SysOps administrator configures an Amazon EC2 Auto Scaling lifecycle hook to send an event to Amazon EventBridge (Amazon CloudWatch Events), which then invokes an AWS Lambda function to configure the EC2 instances. When the configuration is complete, the Lambda function calls the complete-lifecycle-action event to put the EC2 instances into service. In testing, the SysOps administrator discovers that the Lambda function is not invoked when the EC2 instances auto scale. What should the SysOps administrator do to resolve this issue?

  • AAdd a permission to the Lambda function so that it can be invoked by the EventBridge (CloudWatch Events) rule. (correct answer)
  • BChange the lifecycle hook action to CONTINUE if the lifecycle hook experiences a failure or timeout.
  • CConfigure a retry policy in the EventBridge (CloudWatch Events) rule to retry the Lambda function invocation upon failure.
  • DUpdate the Lambda function execution role so that it has permission to call the complete-lifecycle-action event.
Reveal answer & explanation
Correct answer: A

The correct answer is A. Option A: Add a permission to the Lambda function so that it can be invoked by the EventBridge (CloudWatch Events) rule.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon EventBridge routes events between services with rules, enabling event-driven, decoupled architectures. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SOA-C02 Question 234

Single page →
Topic 1 · Question 234

A company has mandated the use of multi-factor authentication (MFA) for all IAM users, and requires users to make all API calls using the CLI. However, users are not prompted to enter MFA tokens, and are able to run CLI commands without MFA. In an attempt to enforce MFA, the company attached an IAM policy to all users that denies API calls that have not been authenticated with MFA. What additional step must be taken to ensure that API calls are authenticated using MFA?

  • AEnable MFA on IAM roles, and require IAM users to use role credentials to sign API calls.
  • BAsk the IAM users to log into the AWS Management Console with MFA before making API calls using the CLI.
  • CRestrict the IAM users to use of the console, as MFA is not supported for CLI use.
  • DRequire users to use temporary credentials from the get-session token command to sign API calls. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Require users to use temporary credentials from the get-session token command to sign API calls.

SOA-C02 Question 235

Single page →
Topic 1 · Question 235

A SysOps administrator has blocked public access to all company Amazon S3 buckets. The SysOps administrator wants to be notified when an S3 bucket becomes publicly readable in the future. What is the MOST operationally efficient way to meet this requirement?

  • ACreate an AWS Lambda function that periodically checks the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.
  • BCreate a cron script that uses the S3 API to check the public access settings for each S3 bucket. Set up Amazon Simple Notification Service (Amazon SNS) to send notifications.
  • CEnable S3 Event Notifications for each S3 bucket. Subscribe S3 Event Notifications to an Amazon Simple Notification Service (Amazon SNS) topic.
  • DEnable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon Simple Notification Service (Amazon SNS) topic. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Enable the s3-bucket-public-read-prohibited managed rule in AWS Config. Subscribe the AWS Config rule to an Amazon Simple Notification Service (Amazon SNS) topic.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 236

Single page →
Topic 1 · Question 236

A company plans to launch a static website on its domain example.com and subdomain www.example.com using Amazon S3. How should the SysOps administrator meet this requirement?

  • ACreate one S3 bucket named example.com for both the domain and subdomain.
  • BCreate one S3 bucket with a wildcard named *.example.com for both the domain and subdomain.
  • CCreate two S3 buckets named example.com and www.example.com. Configure the subdomain bucket to redirect requests to the domain bucket. (correct answer)
  • DCreate two S3 buckets named http://example.com and http://*.example.com. Configure the wildcard (*) bucket to redirect requests to the domain bucket.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create two S3 buckets named example.com and www.example.com. Configure the subdomain bucket to redirect requests to the domain bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed. AWS Config tracks resource configuration changes and evaluates compliance.

SOA-C02 Question 237

Single page →
Topic 1 · Question 237

A SysOps administrator is configuring AWS Client VPN to connect users on a corporate network to AWS resources that are running in a VPC. According to compliance requirements, only traffic that is destined for the VPC can travel across the VPN tunnel. How should the SysOps administrator configure Client VPN to meet these requirements?

  • AAssociate the Client VPN endpoint with a private subnet that has an internet route through a NAT gateway.
  • BOn the Client VPN endpoint, turn on the split-tunnel option. (correct answer)
  • COn the Client VPN endpoint, specify DNS server IP addresses.
  • DSelect a private certificate to use as the identity certificate for the VPN client.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: On the Client VPN endpoint, turn on the split-tunnel option.

SOA-C02 Question 238

Single page →
Topic 1 · Question 238

A SysOps administrator is testing an application that is hosted on five Amazon EC2 instances. The instances run in an Auto Scaling group behind an Application Load Balancer (ALB). High CPU utilization during load testing is causing the Auto Scaling group to scale out. The SysOps administrator must troubleshoot to find the root cause of the high CPU utilization before the Auto Scaling group scales out. Which action should the SysOps administrator take to meet these requirements?

  • AEnable instance scale-in protection.
  • BPlace the instance into the Standby state.
  • CRemove the listener from the ALB.
  • DSuspend the Launch and Terminate process types. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Suspend the Launch and Terminate process types.

SOA-C02 Question 239

Single page →
Topic 1 · Question 239

A web application runs on Amazon EC2 instances behind an Application Load Balancer (ALB). The instances run in an Auto Scaling group across multiple Availability Zones. A SysOps administrator notices that some of these EC2 instances show up as healthy in the Auto Scaling group but show up as unhealthy in the ALB target group. What is a possible reason for this issue?

  • ASecurity groups are not allowing traffic between the ALB and the failing EC2 instances.
  • BThe Auto Scaling group health check is configured for EC2 status checks.
  • CThe EC2 instances are failing to launch and failing EC2 status checks.
  • DThe target group health check is configured with an incorrect port or path. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: The target group health check is configured with an incorrect port or path.

Explanation

AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SOA-C02 Question 240

Single page →
Topic 1 · Question 240

A SysOps administrator notices a scale up event for an Amazon EC2 Auto Scaling group. Amazon CloudWatch shows a spike in the RequestCount metric for the associated Application Load Balancer. The administrator would like to know the IP addresses for the source of the requests. Where can the administrator find this information?

  • AAuto Scaling logs
  • BAWS CloudTrail logs
  • CEC2 instance logs
  • DElastic Load Balancer access logs (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Elastic Load Balancer access logs

Explanation

Elastic Load Balancing spreads traffic across targets in multiple AZs for availability. A load balancer distributes traffic across targets in multiple AZs for availability and scale. This option decouples the components so they scale independently and absorb load spikes.

Showing questions 221–240 of 477 · Page 12 of 24